Main Area and Open Discussion > General Software Discussion

malware or ? #1454789523

<< < (5/8) > >>

wraith808:
I am beginning to suspect these are just arbitrary code numbers assigned by winpatrol to make me buy the pro version.
-holt (February 13, 2016, 02:28 AM)
--- End quote ---

Also, considering the fact that many of us that are looking at the page already have plus, that seems unlikely.

holt:
Screen shot of winpatrol's mysterious report:
malware or ? #1454789523

wraith808:
It's already telling you in the image that they have nothing on the program, i.e. no description found under the blank image.  This is the standard dialog that happens when something tries to register itself.  It's likely that you have a larger problem.  I'd personally be worried.  But if you're not, let it register itself, and then look in the startup locations to see if something has truly registered there before you reboot.  I've had WinPatrol by the simple measure of monitoring save me a lot of trouble when the initial problem didn't trip any other antivirus.

holt:
It's already telling you in the image that they have nothing on the program, i.e. no description found under the blank image.  This is the standard dialog that happens when something tries to register itself.  It's likely that you have a larger problem.  I'd personally be worried.  But if you're not, let it register itself, and then look in the startup locations to see if something has truly registered there before you reboot.  I've had WinPatrol by the simple measure of monitoring save me a lot of trouble when the initial problem didn't trip any other antivirus.
-wraith808 (February 14, 2016, 08:24 PM)
--- End quote ---
Okay, you have my attention and I'm listening and worried.
The past behavior pattern is that no matter what winpatrol option I choose, permit or refuse, it's always back with the same thing on subsequent reboots.
Except--originally it was always the same initial mystery number; now, it changes each reboot.
How about if I post a set of screen shots of winpatrol's startup list with the mystery program rejected, then reboot, permit the item to start, and create a new set. Maybe something will show, maybe not. So here goes...
The next three pictures will be with mystery program rejected by winpatrol from start-up and start menu.
Edit: I rebooted, and the mystery program has not reappeared again yet; if or when it does, I will make a new post here about it, but until it does reappear, I guess there won't be much to say.

mwb1100:
I wish the WinPatrol would give some information on exactly how it was being set as a "Startup Program" in that dialog.  There are several methods such as using various registry keys or being placed in the 'startup folder'.

Clicking on the "Open Folder" or "Properties" link in the warning dialog might give some clue about what the program is.  If nothing else it should give you enough information to copy the file somewhere and do further analysis. Maybe run a "strings" program against the copy to see what text is in the file or submit the file to virustotal, metascan and/or jotti.

You might also want to enable WinPatrol's "Notify me if a Startup Auto Setting is Removed" check-box - it looks like whatever this is that's being registered is also being unregistered (perhaps in an effort to make detection/removal more difficult).

In the Options tab there are some buttons to create a WinPatrol log or Hijack This! log which might be handy, but they don't seem to work for me.

Navigation

[0] Message Index

[#] Next page

[*] Previous page